SEC Proposes to Modernize Custody Rules, Including as to Crypto Assets

On October 1, 2026, the Securities and Exchange Commission (SEC) proposed to amend and modernize

• Investment Advisers Act of 1940 (“Advisers Act”) Rule 206(4)-2 (“IAA Custody Rule”); and
• Investment Company Act of 1940 (“Investment Company Act”) Rule 17f (“ICA Custody Rule,” and, together with the IAA Custody Rule, “Current Custody Rules”)

(Proposed Rule: Adviser and Regulated Fund Custody Rules; Crypto Custody Rules) (“Proposal”).

Among other things, the Proposal would redesignate the IAA Custody Rule as Rule 223-1 under Advisers Act Section 223 and expand the custodial framework for crypto assets by permitting SEC-registered advisers and registered investment companies and business development companies (BDCs) (together, “regulated funds”) to

• self-custody crypto assets (via their advisers for regulated funds) for which a permitted custodian (as defined below) is not available (“Proposed IAA Custody Rule”); and
• use state-chartered limited purpose trust companies as permitted custodians to custody such assets,

in each case, subject to extensive conditions described below (“Proposed ICA Custody Rule,” and, together with the Proposed IAA Custody Rule, the “Proposed Custody Rules”).

Notably, the Proposed IAA Custody Rule would apply only with respect to crypto assets that are “funds or securities,” but the Proposed ICA Custody Rule would apply with respect to crypto assets that are “securities or similar investments,” which includes essentially all investments of the regulated fund, including investments that are not standard “securities” but are held for investment purposes.

Custody of Crypto Assets

The Current Custodian Gap for Crypto Assets

Because the Current Custody Rules were initially developed with traditional assets in mind, advisers and regulated funds managing crypto assets have struggled to apply the Current Custody Rules to crypto assets. This has been particularly challenging as the volume and types of crypto assets continue to proliferate, especially in the case of novel crypto assets.

Additionally, US regulation for advisers that manage crypto assets has been fraught with fits, starts, and perils for years (Bitcoin launched in 2009). In the absence of clear regulation, advisers encountered serious hurdles in adapting to and investing in these assets, resulting in, for example, (1) the loss of investment opportunities for clients whose advisers remained on the sidelines as well as (2) regulatory problems, including enforcement actions, for many advisers who invested in crypto assets anyway. Now, the regulatory situation seems to be turning slowly in a more positive direction.¹

The Current Custody Rules require that:

• Advisers (and unregistered advisers required to be registered) maintain client assets with a “qualified custodian” as defined under the IAA Custody Rule; and
• Regulated funds maintain client assets with certain specified custodians under the Investment Company Act (investment company custodians, and, together with qualified custodians, permitted custodians).

Permitted custodians, however, may lack the technical sophistication necessary to hold and properly safeguard crypto assets, leaving advisers and regulated funds few or no options that comply with the Current Custody Rules’ requirements.

Two Pathways for Crypto Assets: Adviser Self-Custody and State Trust Companies

Two custodial possibilities that emerged during the years of uncertainty were self-custody and state-chartered limited purpose trust companies organized in states that offer specific regulatory frameworks for holding crypto assets. To date, however, the SEC has not sanctioned self-custody under the Advisers Act, but the staff issued a letter on September 30, 2025, stating that it would not recommend enforcement action against advisers and regulated funds that treat state trust companies as banks for custody of crypto assets and related cash and cash equivalents, subject to specified conditions.² Regulated funds have long had the option of self-custody, in which the board of directors accepts the responsibility for self-custody. Boards have not embraced this approach, and it has not been widely used.

Adviser Self-Custody

To provide additional flexibility for the custody of crypto assets, the Proposed IAA Custody Rule permits advisers, subject to certain conditions, to self-custody crypto assets for advisory clients, and the parallel Proposed ICA Custody Rule permits regulated funds to maintain crypto assets through its own adviser. For crypto assets held by a regulated fund, the fund’s board must determine that the asset will be subject to reasonable care if self-custodied with the adviser. Such determination must be made prior to the adviser maintaining the asset and annually thereafter.

Under the Proposal, if an adviser or its related person has possession of any portion of the keys necessary to access and effectuate transactions in the crypto asset, that adviser is considered to have custody of those assets. This broad applicability is meant to address risks unique to crypto assets because a loss of, or unauthorized access to, even a fraction of a key could permanently destroy a client’s access to their crypto asset or create an opportunity for misappropriation of that asset. If a crypto asset is distributed, or “airdropped,” to an adviser, the adviser is not immediately in violation of the self-custody rules but should come in compliance with the self-custody rules as soon as reasonably practicable or otherwise place and maintain the crypto asset at a permitted custodian.

Under the Proposal, adviser self-custody would be subject to the following conditions:

The Proposal indicates that it is not intended to discourage advisers from using third-party service providers to help administer their self-custody programs; however, the adviser must have sufficient expertise to determine that third parties are properly complying with the relevant requirements. Neither is the Proposal intended to require advisers to develop technologies in-house to manage their client’s crypto assets. An adviser may license a service provider’s cryptographic wallet technology and/or software platform to manage the key materials rather than build its own technology in-house, provided the service provider of the wallet technology does not have the ability to access the crypto asset’s key materials or otherwise unilaterally move a client’s crypto asset.

The Proposal highlights several risks related to self-custody regarding crypto assets and the need for heightened safeguards.

Higher risk of permanent loss due to nature of crypto transactions: The Proposal notes that the heightened safeguards set forth regarding crypto assets and crypto key materials are critical because, unlike mechanisms used to transact in more traditional assets, which can often be reversed, transactions in crypto assets by design are difficult or impossible to reverse, even for erroneous or fraudulent crypto asset transactions. Additionally, such transactions generally require the use of public and private cryptographic key pairings, and the loss or theft of key materials also can result in the irreversible loss of crypto assets.

Higher risk of loss due to novelty of the custodial role and lack of specialized expertise, lack of third-party interaction or regarding custody, additional conflicts of interest, and crypto network recordkeeping:

• Advisers are not customarily engaged in the business of custody, and many of them therefore may lack the relevant experience and/or necessary controls to safeguard an asset effectively.
• Heightened risk of loss due to cyberattacks as safeguarding crypto assets and cryptographic keys often requires highly specialized technical knowledge and capabilities along with proficiency in cybersecurity practices.
• Potential blurring of the lines between the advisory and custodial roles when the same party fills both may subject client assets to greater risk due to the adviser’s financial condition — having to work with a third-party custodian lessens the likelihood the adviser will engage in unauthorized trading in a client’s account.
• The self-custodial role goes beyond the services customarily associated with advisory businesses and presents heightened concerns regarding conflicts of interest.
• Custodial risks associated with the immutability of records on crypto networks may be heightened in the context of permissionless crypto networks where anyone can participate in the network without permission (compared to permissioned crypto networks where participants must be approved to access the crypto network).

Self-Custody By Regulated Funds

The Proposed Custody Rules would permit a regulated fund’s adviser to custody the regulated fund’s crypto assets if the adviser complies with the adviser self-custody rule and if the regulated fund’s board engages in oversight of the adviser’s custody arrangements. The required oversight would include:

The board may also consider such other information not explicitly required in the Proposed Custody Rules as it may deem appropriate; in the proposing release, the SEC specifically cites the examples of reports or assessments of the adviser’s crypto safeguarding arrangements by a third party and/or the availability of insurance or other reimbursement arrangements in the case of losses.

State Trust Companies as Crypto Asset Custodians

The Proposed Custody Rules would add state trust companies as a new category of permitted custodian for crypto assets. Prior to engaging a state trust company, and annually thereafter, the adviser or regulated fund must have a reasonable basis, after inquiry, for believing that the state trust company is authorized by the relevant banking authority to provide crypto asset custody and that the state trust company maintains and implements written policies and procedures reasonably designed to safeguard crypto assets from risk of theft, loss, misuses, and appropriation. The adviser or regulated fund must also receive and review the state trust company’s most recent audited financial statements and internal control report. The advisory client’s crypto assets must be segregated from the state trust company’s proprietary assets.

Proposed Disclosure and Reporting Requirements

The Proposal includes certain conforming amendments to Form ADV to reflect the Proposed Custody Rules, including, among other things, adding new crypto-related questions in Part 1A Schedule D to assist in providing a view into the complexity and risk exposure of the adviser’s crypto self-custody activities:

• questions to Item 9 that address an adviser’s reliance on certain exceptions under the Proposal to certain custody practices, including, for example:
  • whether the adviser has self-custody of client crypto assets and, if so, the approximate amount, the total number of clients for which the adviser has self-custody, and the total number of crypto asset addresses that hold clients’ crypto assets in the adviser’s self-custody
  • exception for standing letters of authorization
  • exception for discretionary trading authority
  • exception for inadvertent custody, etc.
• questions in Item 5.K. and Section 7.B. of Schedule D that address crypto assets self-custodied on behalf of separately managed account clients and private funds
• questions to Schedule D regarding tokenized private funds
• questions regarding whether an independent public accountant prepares an internal control report with respect to custodial services related to self-custody of client crypto assets and reports identifying information about any such accountant
• questions for advisers that self-custody as to:
  • whether account statements are sent at least quarterly to the adviser’s clients or if the adviser transmits the information required quarterly in a human-readable and reasonably usable electronic format
  • for advisers to pooled investment vehicles other than regulated funds, questions as to the specific audit arrangements for the funds, approximate amounts of crypto assets the adviser self-custodies, and the total number of crypto asset addresses that store the crypto assets of which the adviser has self-custody
• terms and definitions to the Glossary of Terms, including “crypto asset,” “crypto asset address,” and “self-custody,” which are referenced in the proposed Form ADV; Part 1A questions on adviser self-custody of crypto assets

Additionally, registered advisers will be required to consider how, if adopted, the Proposal may affect the Form ADV Part 2A disclosure points, including in Item 4 (Advisory Business) and Item 8 (Methods of Analysis, Investment Strategies, and Risk of Loss), especially regarding material risks and potential conflicts of interest related to investing in crypto assets and holding crypto assets in self-custody. The Proposal notes that this may require additional disclosure beyond what is specifically instructed to be disclosed in Part 2 and that this additional disclosure may be made in Part 2 or by separate disclosure. This disclosure regarding material risks and potential conflicts would also impact regulated funds and their disclosure documents. Such risks and material disclosures would include, for example, the risks described above and points regarding recourse if crypto assets are lost or stolen.

Additional IAA Custody Rule Modernization

In addition to the provisions related to custody of crypto assets, the Proposal also includes:

• significant modifications in IAA Custody Rule addressing a particularly important open point regarding “authorized trading” and delivery versus payment (DVP) trading authority versus non-DVP trading authority³
• consolidation of previous SEC guidance, such as regarding the use of a standing letter of authorization (SLOA) into the IAA Custody Rule⁴
• certain updates to related recordkeeping and disclosure requirements, including modifications to Form ADV

Discretionary Trading Authority

The Proposal notes that, “Over the years, Commission staff and members of industry have engaged in a dialogue around whether authorized trading on a non-DVP (delivery versus payment) basis constitutes custody under the Advisers Act custody rule.”⁵ In the course of that dialogue, many advisers with separately managed account clients have operated under the assumption that discretionary trading authority provided in the investment management agreement (rather than more general authority to direct the client’s assets as described in the Advisers Act custody rule — for example, check-writing authority, a general power of attorney, etc.) does not constitute “custody” for purposes of the IAA Custody Rule.⁶ Hence, advisers with such discretionary trading authority have taken the position that they do not have custody of the client’s assets under the Advisers Act custody rule where, as is common, the separately managed account client engages and enters into separate agreements with the adviser and the custodian authorizing the following:

• the adviser to exercise discretionary trading authority regarding the account
• the custodian to execute instructions from the adviser (but not requiring the custodian to monitor those instructions for compliance with the investment management agreement or otherwise supervise the investment adviser)⁷

The Proposal warns that broadly drafted grants of authority could be treated as a general power of attorney that confers custody and provides that an adviser would be exempt from having custody due to its discretionary trading authority regarding both DVP and non-DVP trading if the adviser:

• executes trades only from and into designated client accounts in the client’s name or that the issuer records the transfer in the client’s name (including in respect of non-DVP trading, for example, investments in loans, private funds, and other privately offered securities)
• has no authority (under the discretionary trading arrangement or otherwise) to transfer client funds and securities from the designated client account to an account in its own name or to an account the adviser or its related person controls, or to any account that is not the client’s unless the client directs such transfer in connection with the trading, nor does the adviser have the authority to have the transfer recorded by the issuer in the adviser’s own name or that of a related person
• complies with the Advisers Act custody rule for any other activities, rights, or authorities that otherwise cause it to have custody separate from such discretionary trading authority and with the requirements of any corresponding exceptions under the Advisers Act custody rule that the adviser may exercise pursuant to such custody

As to “inadvertent custody” due to the custodian’s standard form that provides the adviser authority regarding the client’s funds or securities that is not permitted in the investment management agreement, the Proposal excepts the adviser from Advisers Act custody rule compliance if:

• the adviser did not recommend, request, or require the custodian’s selection
• upon discovering the custodial agreement grants such authority, the adviser promptly notifies the client and custodian in writing, repudiates the authority, and asks that the agreement be amended (i.e., that the language be removed or replaced)

The Proposal does not require the adviser to review all custodial agreements but does require the adviser to have policies and procedures to review each custodial agreement to which it has access and follow the requirements immediately above.

Audit Provision

The Proposed IAA Custody Rule includes amendments to the audit provision that would:

Additional ICA Custody Rule Modernization

Additionally, the Proposed ICA Custody Rule would:

• add references to BDCs in certain Investment Company Act rules; for example, Section 17(f) governing custody of securities would apply to BDCs as if they were registered closed-end investment companies, which is consistent with industry practice
• remove the condition in current Rule 17f-1 and make it permissible for regulated funds to custody their securities or similar investments with all broker-dealers registered under Section 15(b)(1) of the Securities Exchange Act of 1934 (Exchange Act) where the broker-dealer’s custody of the securities or other investments is subject to the requirements of Rule 15c3-3 under the Exchange Act (versus custody with “[m]ember national securities exchange”)
• add a new item to Form N-CEN requiring regulated funds to report whether they (or a series or class thereof) are a “tokenized fund” and to provide a definition of the same
• correct certain errors and inconsistencies

Amendments to Recordkeeping Rules

The Proposal also includes amendments to the recordkeeping rule that, among other things, require:

• advisers that have self-custody of client crypto assets to make and keep certain records related to the proposed self-custody rules
• advisers with custody of client crypto assets that are maintained at a state trust company under the proposed state trust company rules to make and keep certain records
• advisers that rely on the SLOA exception to maintain and preserve any SLOAs and related records in connection with reliance on the exception

Additionally, the Proposal includes amendments to the recordkeeping rule to provide that records required to be maintained and preserved under the applicable recordkeeping rules may be maintained and preserved on a crypto network, provided that the adviser or regulated fund can provide, promptly upon request by the SEC (including its examiners and other representatives), such records to the SEC in a human-readable and reasonably usable electronic format.

Request for Comment

The Proposal requests comments regarding all aspects of the Proposal and includes extensive questions, including regarding risks associated with crypto assets. Comments are due December 7, 2026.